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"The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 

THE REPLY FILED 25 September 2008 FAILS TO PLACE THIS APPLICATION IN CONDITION FOR ALLOWANCE. 

1 . ^ The reply was filed after a final rejection, but prior to or on the same day as filing a Notice of Appeal. To avoid abandonment of this 

application, applicant must timely file one of the following replies: (1 ) an amendment, affidavit, or other evidence, which places the 
application in condition for allowance; (2) a Notice of Appeal (with appeal fee) in compliance with 37 CFR 41 .31 ; or (3) a Request 
for Continued Examination (RCE) in compliance with 37 CFR 1.114. The reply must be filed within one of the following time 
periods: 

a) ^ The period for reply expires 3_months from the mailing date of the final rejection. 

b) n The period for reply expires on: (1) the mailing date of this Advisory Action, or (2) the date set forth in the final rejection, whichever is later. In 

no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of the final rejection. 

Examiner Note: If box 1 is checked, check either box (a) or (b). ONLY CHECK BOX (b) WHEN THE FIRST REPLY WAS FILED WITHIN TWO 

MONTHS OF THE FINAL REJECTION. See MPEP 706.07(f). 
Extensions of time may be obtained under 37 CFR 1 .136(a). The date on which the petition under 37 CFR 1 .136(a) and the appropriate extension fee 
have been filed is the date for purposes of determining the period of extension and the corresponding amount of the fee. The appropriate extension fee 
under 37 CFR 1 .1 7(a) is calculated from: (1) the expiration date of the shortened statutory period for reply originally set in the final Office action; or (2) as 
set forth in (b) above, if checked. Any reply received by the Office later than three months after the mailing date of the final rejection, even if timely filed, 
may reduce any earned patent term adjustment. See 37 CFR 1 .704(b). 
NOTICE OF APPEAL 

2. □ The Notice of Appeal was filed on . A brief in compliance with 37 CFR 41 .37 must be filed within two months of the date of 

filing the Notice of Appeal (37 CFR 41 .37(a)), or any extension thereof (37 CFR 41 .37(e)), to avoid dismissal of the appeal. Since a 
Notice of Appeal has been filed, any reply must be filed within the time period set forth in 37 CFR 41.37(a). 
AMENDMENTS 

3. □ The proposed amendment(s) filed after a final rejection, but prior to the date of filing a brief, will not be entered because 

(a) n They raise new issues that would require further consideration and/or search (see NOTE below); 

(b) IIII They raise the issue of new matter (see NOTE below); 

(c) □ They are not deemed to place the application in better form for appeal by materially reducing or simplifying the issues for 

appeal; and/or 

(d) IIII They present additional claims without canceling a corresponding number of finally rejected claims. 

NOTE: . (See 37 CFR 1 .116 and 41.33(a)). 

4. □ The amendments are not in compliance with 37 CFR 1.121. See attached Notice of Non-Compliant Amendment (PTOL-324). 

5. O Applicant's reply has overcome the following rejection(s): . 

6. □ Newly proposed or amended claim(s) would be allowable if submitted in a separate, timely filed amendment canceling the 

non-allowable claim(s). 

7. 1^ For purposes of appeal, the proposed amendment(s): a) ^ will not be entered, or b) □ will be entered and an explanation of 

how the new or amended claims would be rejected is provided below or appended. 

The status of the claim(s) is (or will be) as follows: 

Claim(s) allowed: . 

Claim(s) objected to: . 

Claim(s) rejected: 1-20 . 

Claim(s) withdrawn from consideration: . 

AFFIDAVIT OR OTHER EVIDENCE 

8. □ The affidavit or other evidence filed after a final action, but before or on the date of filing a Notice of Appeal will not be entered 

because applicant failed to provide a showing of good and sufficient reasons why the affidavit or other evidence is necessary and 
was not earlier presented. See 37 CFR 1 .1 16(e). 

9. □ The affidavit or other evidence filed after the date of filing a Notice of Appeal, but prior to the date of filing a brief, will not be 

entered because the affidavit or other evidence failed to overcome all rejections under appeal and/or appellant fails to provide a 
showing a good and sufficient reasons why it is necessary and was not earlier presented. See 37 CFR 41 .33(d)(1 ). 

1 0. □ The affidavit or other evidence is entered. An explanation of the status of the claims after entry is below or attached. 
REQUEST FOR RECONSIDERATION/OTHER 

1 1 . ISI The request for reconsideration has been considered but does NOT place the application in condition for allowance because: 

See Continuation Sheet. 

12. □ Note the attached Information Disclosure Statement{s). (PTO/SB/08) Paper No(s). 

13. □ Other: . 

/Cam Y Truong/ 

Primary Examiner, Art Unit 2169 
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Continuation of 1 1. does NOT place the application in condition for allowance because: Applicant's arguments with regard to the rejection 
under 35 U.S.C. 103(a) has been fully considered, but there are not persuasive. Examiner respectfully disagree all allegations as argued. 
Examiner, in her previous office action gave detail explanation of claimed limitation and pointed out exact locations in the cited prior art. 
Examiner is entitled to give claim limitations their broadest reasonable interpretation in light of the specification. See. MPEP 2111[R-1] 
Interpretation of Claims-Broadest Reasonable Interpretation During patent examination, the pending claims must be 'given the broadest 
reasonable interpretation consistent with the specification'. Applicant always has the opportunity to amend the claims during prosecution 
and broad interpretation by the examiner reduces the possibility that the claim, once issued, will be interpreted more broadly than is 
justified. In re Prater, 162 USPW 541,550-51 (CCPA 1969). 

Applicants argued that, they are not able to locate any reference in paragraph 23 to a "medium" that includes a "signal" or "carrier wave". 
In response Applicant's argument, instant specification discloses "In general, an algorithm refers to a self- consistent sequence of steps 
leading to a desired result, where a "step" refers to a manipulation of physical quantities which may, though need not necessarily, take the 
form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated. It is common 
usage to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like" (page 5, paragraph 0023). The 
rejection under U.S.C. 101 is maintained. 

Applicants argued that, the cited art fails to disclose "identify entries in the subset of log file entries that belong to a complete client session; 
grouping entries in the subset that belong to a complete client session" in claim 1. Examiner respectfully disagrees. 
In response Applicant's argument, Kaler teaches BeginSession is called by an entity before it fires events to register its entity and instance 
names. EndSession is called by an entity after it completes firing events (page 16, paragraph 0251-0252). The event log window highlights 
all events in the specified time range, part of which represent a call tree. The event viewing window presents data on a single event. The 
timeline window highlights the specified time range as well as shows performance peaks, and the summary window tallies the events in the 
time range and presents a summary (page 20, paragraph 0306; session range see also figure 19). The VSA maintains a log of all of the 
events that have been collected (page 18, paragraph 0283). The developer had to modify his or her application, by writing trace statements 
in the code and having the application write to a log file what was going on at different places in the network. Then all of the log files would 
need to be collected, merged, and sorted. The developer would then have to sift through the data in a time-intensive fashion and attempt to 
determine the performance problem (page 1, paragraph 0009). 

Applicants argued that, the cited art fails to disclose "allocate[s], for each identified user session, an index to identify all records in the ring 
buffer that are associated with the identified user session and to identify all start or end records; process[es] the index to group all records 
in the ring buffer belonging to a complete user session, to output the grouped records for further analysis." In claim 8. Examiner respectfully 
disagrees. 

In response Applicant's argument, Kaler teaches the control station can specify filters, for example a first filter and a second filter. The 
second filter can be more detailed and comprehensive than the first filter. The control station can also specify a reset condition. It can also 
specify how many events the LEC should store in its circular buffer (e.g. ring buffer) store (page 21, paragraph 0321; see also figure 22 A- 
B). Also Moran teaches session identifier is an index to a data structure specifying the conditions for this particular invocation of this sensor. 
This data structure includes the host that the sensor collected data from and the options specified for this invocation (page 18, lines 41-45). 
The utmp file tracks that are currently logged in and the wtmp file provide a historical record, including both completed login sessions and 
active sessions. The lastlog file contains the time of the last login for each user (column 19, line 59 to column 20, line 10). The analysis 
engine then checks the timestamps on files in each user's home directory for consistency with the recorded login session (column 26, lines 
26-35). The analysis engine examines the last-access time of each SetUID command-this is a reasonable approximation of when the 
command was last run, because there are a few other operations that update the last-access time, but these are uncommon/infrequent. 
This access time is compared to the timestamps on files that the command is expected to access (column 34, lines 43-67). 
Applicants argued that, the cited art fails to teach or suggest the requirements of a system for session-based processing of log files which 
includes "a processing engine to process a subset of the plurality of server request entries to group the server request entries by session 
using the session identifier in each server request entry." in claim 11. Examiner respectfully disagrees. 

In response Applicant's argument, Kaler teaches a developer may be writing or have written a server component that performs credit 
checks. This software component is used in a larger application that performs order entry processing. There are several other server 
components in the system some of which run on the same sen/er and some which run on a separate server (page 1, paragraph 0008). 
Filter reduction is the process of modifying or creating a new version of a Boolean expression by binding a subset of the variables within the 
expression (page 13, paragraph 0215). Also, Moran teaches the sensor sends the raw records to the analysis engine plus records for each 
login session (beginning and end), with the method of closing the session identifier: by logout record, by reboot, by tty line reused (column 
24, lines 25-34). 

Applicants argued that, the cited art fails to teach or suggest the requirements "system for parsing web site logs one session at a time" by 
processing a subset of network session data "to group said network session data by session" and "generating a first output file containing 
network session data grouped by session." In claim 18. Examiner respectfully disagrees. 

In response Applicant's argument, Kaler teaches data Objects can be used to access different types of data, including web pages, 
spreadsheets, and other types of documents (page 4, paragraph 0072). An event field is from a group comprising arguments, unique i.d., 
dynamic event data, exception, return value, source component, source handle, source machine, source process, source session, source 
thread, target component, target handle, target machine, target process, target process name, target session, and target thread (claim 4). 
Also, Moran teaches in determining a login session for a user account, the wtmp file is the primary source, containing entries for both login 
and logout. The access time on the logout RC file and the last-modification time on the shell's history file provide secondary evidence for 
the last logout on that account; example indirect sources are entries in other log files (column 23, lines 5-25). 

Applicant's arguments with regards to the dependent claims rely upon the arguments set forth with respect to claims 1 , 8, 1 1 and 18, which 
has been addressed above. Consequently, the rejection of claims 1-20 under 35 U.S.C. 102(e) and 103(a) is maintained.. 
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